Authorities and Limitations in Sharing Information Between Public Health Agencies and Law Enforcement

Issue Brief

Introduction

Public health agencies and law enforcement share responsibility for protecting the public and promoting its welfare. Their cooperation and collaboration are crucial to all components of emergency management: preparedness, mitigation, response, and recovery. Whether a public health emergency is caused by natural, accidental, or intentional means, data about the emergency and its impacts are crucial for both public health and law enforcement to carry out their respective functions. For this reason, "information sharing" is one of the 15 capabilities for national public health preparedness standards developed by CDC to assist state and local public health departments in their strategic planning.1

Public health officials must understand their legal authority and limitations in providing information to law enforcement. In particular, public health agencies are subject to laws that provide for confidentiality of individually identifiable information. This issue brief examines the legal basis for public health agencies to share identifiable information with law enforcement and the benefits and challenges of working jointly to investigate public health events that may involve criminal activity. For information on public health authority and information sharing in general, see the Public Health Collection, Use, Sharing & Protection of Information Issue Brief that is part of the Public Health & Information Sharing Toolkit. (Download a printable PDF.)

I. Potential Areas for Information Sharing

While public health and law enforcement both protect society, they differ in their missions and approaches. Public health is responsible for protecting and promoting the health of communities through prevention, policy development, and population health surveillance. Law enforcement is responsible for identifying and apprehending people who have committed crimes or pose a threat to others.2 Common terminology used in public health and law enforcement reflects their different roles. For example, when used in the public health context, "surveillance" refers to the ongoing systematic collection, analysis, interpretation, and dissemination of data regarding a health-related event for use in public health action to reduce morbidity and mortality and to improve health. When used in a law enforcement context, "surveillance" means observations of premises or person(s) under suspicion.3 Similarly, public health conducts "investigations" to determine the cause of disease and prevent its spread. Law enforcement conducts "investigations" to identify suspects, collect evidence, and solve crimes.4

With regard to a public health threat or emergency, law enforcement's role might include:

Locating an infected person who is either knowingly or unknowingly spreading a disease.

Securing healthcare facilities and public health sites, such as mass vaccination or treatment sites.

Controlling crowds.

Investigating scenes of suspected biological or chemical terrorism.

Protecting national stockpiles of vaccines or other medicines.5

For most security purposes, such as controlling crowds or securing facilities, law enforcement should not need identifiable information. However, for some purposes, public health agencies may need to provide identifiable personal, epidemiological, or medical information about patients or other members of the public to enable law enforcement staff to do their job and protect themselves from potentially harmful exposure or carrying contaminants from a scene.

II. Joint Investigations

Public health agencies and law enforcement may conduct joint investigations around public health incidents that involve suspected or confirmed criminal activity. Historical examples include:

Twelve laboratory workers contracted Shigella dysenteriae after eating pastries left in the lab's break room. A lab worker was sentenced to 20 years in prison as a result of contaminating the pastries, most likely with the lab's stock culture.6 7

A supermarket notified state and federal agencies of an upcoming recall of ground beef because of customers' complaints of acute illness after eating the product. High concentrations of nicotine were detected in ground beef. A supermarket employee plead guilty to poisoning the meat with an insecticide containing nicotine and was sentenced to nine years in prison.8

Over a six-week period, there was an unusual, increased prevalence of cardiopulmonary arrests in a Veterans Administration hospital associated with injections of pancuronium bromide (a muscle relaxant) during a specific shift. Two nurses were indicted for murder, attempted murder, and conspiracy to commit murder.9 All charges against the nurses were eventually dismissed.10

Joint investigations may benefit both public health and law enforcement as they carry out their respective roles in protecting the public. Law enforcement may benefit from assistance and information from disease investigation experts. Law enforcement's information may help public health to prevent further spread of a disease or decrease the impact of future threats. Working together strengthens relationships between public health professionals and officers, thereby facilitating future communication and information exchange. Taking advantage of both law enforcement and public health perspectives, joint investigations may be more thorough and cover issues that may have been overlooked during separate investigations. Moreover, public health and law enforcement may be able to pool resources and avoid duplication of efforts through joint interviews or questionnaires that address both public health and law enforcement concerns.11 Time and efficiency are crucial, especially when one event can require hundreds of interviews. In particular, bioterrorism investigations require close cooperation between public health and law enforcement, which entails some blurring of their usual roles. Public health investigators may function as forensic experts if there is a prosecution, and law enforcement will try to mitigate harm by identifying and arresting the perpetrators who initiated the outbreak.12

While valuable, joint public health and criminal investigations also present risks and challenges. Community trust is essential to carry out public health's mission. Underserved communities that are traditionally in greatest need of public health services may be suspicious of collaboration between public health and law enforcement.13 Minorities may fear that their race, status, or ethnicity will subject them to profiling or other unwanted attention.14 Undocumented individuals may fear detection and deportation. The presence of law enforcement officers may have a "chilling effect" on patients being interviewed and on the medical professionals with whom public health routinely works and upon whom traditional public health surveillance (through mandatory disease reporting) depends.15

Issues may also arise due to tensions between public health's interest in protecting the population's health and law enforcement's interest in collecting evidence that will be admissible in criminal investigations.16 For example, during an evolving epidemic with suspected terrorism, public health officials may seek to warn the public, while law enforcement argues that secrecy is essential to successfully identify, apprehend, and prosecute the perpetrators.

Joint investigations also raise legal challenges, because legal constraints for public health and criminal investigations differ. The U.S. Supreme Court has steadfastly upheld the broad powers of the state to protect its citizens from threats to public health.17 These powers grant public health agencies wide latitude in conducting investigations, including the authority to access detailed and sensitive health information about individuals and their contacts and to obtain biological specimens for testing when necessary to prevent and control disease outbreak or other public health threats.18 In contrast, law enforcement is subject to constitutional constraints that limit the state's powers to prosecute and punish individuals for crimes.19

Successful prosecution of the perpetrators of crimes that use biologic or chemical agents requires admissible evidence. In gathering evidence, the government must comply with the Fourth Amendment prohibition against unreasonable searches and seizures and the Fifth Amendment privilege against self-incrimination. It must also collect and process evidence with a proper chain of custody so that it can be authenticated by an expert and admitted into evidence. Evidence that is not obtained, handled, and secured to meet standards for criminal prosecution may be excluded from trial.

In the context of bioterrorism, the presence of ill persons may be the first sign of an attack; criminal intent may be unclear or may not be immediately apparent. At the onset of the first anthrax attack in 2001, a Florida media company's employee's symptoms triggered only a public health investigation.20 But when findings strongly suggested a deliberate and criminal act, the public health investigation was joined by a criminal investigation.21 Because public health officials typically do not investigate criminal activity, a delayed criminal investigation may mean that public health agencies have already obtained statements, collected evidence, and tested specimens, all of which may be legally inadmissible or lacking information relevant to law enforcement for criminal prosecution.

CDC and the Department of Justice convened a Public Health and Law Enforcement Emergency Preparedness Workgroup that developed a framework, action steps, and tools to strengthen collaboration between public health and law enforcement while minimizing the challenges. These include:

"Coordinated Implementation of Community Response Measures (Including Social Distancing) to Control the Spread of Pandemic Respiratory Disease: A Guide for Developing a Memorandum of Understanding for Public Health, Law Enforcement, Corrections, and the Judiciary"23

Joint investigative training can develop effective work relationships between public health and law enforcement, promote an understanding of investigative methods, and facilitate communication and information exchange. CDC, in partnership with other agencies and organizations, developed "Forensic Epidemiology," a module for the joint training of law enforcement and public health officials.25 Public health and law enforcement are also encouraged to consult investigation manuals, including the FBI-CDC "Criminal and Epidemiological Investigation Handbook."26

As a result of ad hoc interagency collaboration during World War II, the National Security Act of 194727 was enacted to coordinate military and foreign intelligence.28 The National Security Act mandated that information be communicated up the chain of command, not horizontally between departments.29 The events of 9/11 demonstrated the need for horizontal communication to establish more comprehensive intelligence.30 The USA Patriot Act of 200131 removed barriers prohibiting horizontal communication, thereby allowing information to be shared between the law enforcement and intelligence communities to protect national security.32 Complementing the Patriot Act, the Department of Homeland Security (DHS) was established by the Homeland Security Act of 200233 to improve information sharing among federal, state, and local levels of government and with private sector organizations.34 The Intelligence Reform and Terrorism Prevention Act (IRTPA) of 200435 was a part of the response to horizontal communication demands. IRTPA works to expand information sharing beyond the scope of DHS and the FBI by including law enforcement as a partner with a significant role to play in inter-departmental intelligence collaboration.36

IRTPA led to the creation of the Information Sharing Environment (ISE).37 ISE embraces all information pertinent to national security and safety of Americans.38 ISE uses "fusion centers" as a means to gather and share information.39 Across the nation, states and local governments have established fusion centers to facilitate the sharing of information among multiple agencies and build their intelligence capabilities.

"Fusion" refers to the overarching process of managing the flow of information and intelligence across all levels and sectors of government and private industry.40 The "fusion process" is intended to turn information and intelligence from different sources into actionable knowledge.41 In other words, information is collected from a variety of sources, integrated, evaluated, and analyzed to create meaningful information about potential threats and risk assessments that is disseminated to stakeholders.42 Fusion centers share information with participants within their jurisdiction and with the federal government and other jurisdictions through a national network of fusion centers.43 Participants may include public and private entities from sectors such as banking and finance, education, government, health and public health services, postal and shipping, retail, and transportation.44 Public health is being sought as a valuable partner to routinely share information with law enforcement, homeland security, and other agencies to prevent bioterrorism and improve preparedness.45

As of February 2013, there are 78 state and local fusion centers, covering every state, the District of Columbia, three U.S. territories, and many major metropolitan areas.46 State and local fusion centers vary in organization, function, and participants. Generally, fusion centers involving public health entities focus on bioterrorism and similar threats but may include "all crimes" and assist in providing intelligence and risk assessment for "all hazards" to protect the security of the homeland.

Effective bioterrorism planning, prevention, and response require information sharing among various entities, including public health agencies, healthcare providers, and law enforcement officials.47 For example, public health may contribute information about suspicious symptoms, abnormal environmental conditions that may be caused by an emergent disease or agent, or abnormal patterns and trends indicative of production or abuse of narcotics. Public health personnel may also contribute their specialized subject-matter expertise to assist in the analysis and interpretation of this information.48 In many cases, information may be shared in a way that does not identify individuals-for example, aggregate data about the number of individuals exposed to an infectious condition within a population or who have exhibited symptoms of a condition that is a known bioterrorism agent. However, at times, identifiable information will be needed to prevent, prepare for, and respond to bioterrorism, including epidemiological and laboratory data about the specific health status of identifiable individuals or health status of known groups such as families, assemblies, employees, or persons within defined geographic boundaries.49

Public health's contribution of information through fusion centers raises similar issues to those which arise through joint investigations. Public health benefits through cross-sector partnerships with law enforcement and other agencies and pooling of expertise and resources. At the same time, public health's core mission suffers if public health agencies act-or are perceived to act-as law enforcement's agents. Privacy and civil liberties advocates warn against fusion centers' promotion of a surveillance-based society and cite abuses and mission creep by some fusion centers that result in suspicious activity reports about individuals who are engaging in lawful activities.50

The potential role of public health as a data contributor to fusion centers is an emerging area. Public health officials should be clear about their agency's role in contributing information, what information is being requested and for what purpose, and what information may be provided in turn to public health.

Memoranda of understanding or data-sharing agreements may be used to define public health's role and terms and conditions for information sharing through fusion centers. Although not an exhaustive list, these terms might include:

Information to be shared.

Purpose for which information is to be used.

Method for sharing.

Who has access to the information.

Acceptable uses and linkages of the information.

Protection and security of the information.

Retention, reuse, and further sharing of the information.

Audits or other mechanisms to monitor proper use.

Accountability and enforcement of terms of agreement.

Legal counsel should review proposed information to be shared and terms of use to ensure disclosure is permitted under federal and state laws.

The federal government has provided financial resources, personnel, training, and other support for defining, developing, operating, and standardizing fusion centers at the local, state, and federal levels. The Department of Justice's Global Justice Information Sharing Initiative, in collaboration with the Department of Homeland Security, has developed guidelines for establishing and operating fusion centers,51 baseline capabilities and operational standards,52 and recommended actions to integrate the public health and healthcare communities into the fusion process.53 To develop and operate a fusion center, law needs to be reviewed regarding the collection, sharing, and dissemination of information. Appropriate privacy and civil liberties policies must be in place, including policies to protect personally identifiable information. To aid with developing or revising privacy policies, the Global Justice Information Sharing Initiative has developed a privacy policy development guide and a privacy and civil rights policy template for justice information systems.54

IV. Public Health Investigations, Information Sharing, and U.S. Constitutional Rights

The U.S. Constitution creates fundamental rights to protect individuals from arbitrary actions by the government. As noted above, these fundamental rights include the Fourth Amendment prohibition against unreasonable searches and seizures and the Fifth Amendment protection of the accused against self-incrimination. If evidence is obtained in violation of these rights, it may be inadmissible in a criminal prosecution. Further, to be admissible, the chain of custody of evidence must be documented to link this evidence to the scene of the crime. When working with law enforcement, public health officials must understand their legal authority and limits to ensure individual rights are protected and criminal investigations are not compromised.

Fourth Amendment Prohibition on Unreasonable Searches and Seizures

In gathering evidence, the government must comply with the Fourth Amendment warrant requirements or meet an exception. The Fourth Amendment, which is enforceable against the states through the Fourteenth Amendment, provides:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

A search occurs when government action infringes upon an expectation of privacy that society recognizes as reasonable-for example, an individual's expectation of privacy in their home, business, vehicle, and person. Searches also include the collection and subsequent analysis of biological samples.55 A seizure occurs when government action meaningfully interferes with an individual's possessory interest in property, such as seizure of items that belong to the individual. The basic purpose of this amendment is to safeguard the privacy and security of individuals against arbitrary invasions by governmental officials.

Absent an exception, the Fourth Amendment applies to health and safety inspections and to public health investigations, requiring an administrative warrant. The exception or warrant requirement applies to searches and seizures on both residential and commercial property.56 However, the standard for an administrative warrant is not as high as it is for criminal investigations. In administrative searches, probable cause is supported not by the traditional definition of likelihood to believe that evidence of a crime will be found in the area to be searched, but rather by reasonable legislative or administrative standards for conducting an area search with respect to a particular dwelling.57

Evidence found during an administrative search may be admissible in a criminal prosecution if two criteria are met. First, the information must be collected and processed with a proper chain of custody so that it can be authenticated by an expert and admitted into evidence. The chain of custody connects evidence to a crime scene. Since careful handling is also critical to proper epidemiologic investigations, this standard of care should be maintained in all investigations. Second, the evidence must be obtained as part of a legitimate public health investigation.58 In other words, a public health agency must be acting in its public health capacity. Public health investigations cannot be used as a pretext to gather evidence of criminal activity.

Public health professionals must avoid serving as agents to law enforcement, lest they jeopardize both criminal proceedings and the public's trust.

In many investigations, the owner or occupier gives consent for public health investigators to enter and search their premises, to copy records, take specimens or samples for testing, and remove evidence that might be relevant to the public health concern. Knowing and voluntary consent by an individual with actual or apparent authority over the premises to be searched or items to be seized is an exception to the warrant requirement. The search is limited to the scope provided in the consent. Thus, if an individual gives investigators permission to search his room, investigators cannot expand the search to other rooms or the individual's vehicle.59

Additional exceptions to the warrant and probable cause requirement might apply to public health inspections and investigations. These include:

Pervasively regulated businesses. Warrantless searches are permitted of certain industries that have a history of pervasive regulation. The history of government oversight prevents those engaged in these businesses from holding any reasonable expectations of privacy. Junkyards are an example of a pervasively regulated business; consequently, a New York statute that authorized warrantless searches of junkyards was valid.60 Most businesses that can endanger the public health, such as food service establishments or health facilities, require a permit or license to operate. Through licensing, these businesses are put on notice that they are subject to warrantless searches during regular business hours as a condition of doing business.61

Checkpoints and other blanket searches. Warrantless, suspicionless searches are valid at places where the need to enforce public safety is particularly acute, such as borders, airports, and government buildings. Appropriately tailored roadblocks may also be permitted, for example, to thwart an imminent terrorist attack or to catch a dangerous criminal who is likely to flee by way of a particular route. Permitted checkpoint programs and blanket searches depend on the primary programmatic purpose; for example, motor vehicle checkpoints are not permitted for the primary purpose of uncovering evidence of criminal wrongdoing.62

Emergency circumstances. Warrantless searches are permitted for exigent circumstances if delay associated with obtaining a warrant is likely to lead to injury, public harm, or the destruction of evidence.63

Open-fields doctrine. No warrant is required to inspect a public place, such as the eating area of a restaurant, testing pollutants emitted into the open air, or examining the exterior of an apartment and refuse dumpster.64

Fifth Amendment Privilege Against Self-Incrimination

The Fifth Amendment to the Constitution provides that "[n]o person … shall be compelled in any criminal case to be a witness against himself." The privilege prevents the government from forcing a defendant to testify against himself. The privilege also applies to "custodial interrogations" and prevents the government from forcing a person to talk to the police and answer potentially incriminating questions concerning a crime.

Before conducting a custodial interview of a suspect, a government agent must provide the familiar "Miranda warnings," namely, "you have the right to remain silent," "anything you say or do can and will be held against you in a court of law," "you have the right to an attorney," and "if you cannot afford an attorney, one will be provided for you." The suspect can "take the Fifth" to avoid saying something incriminating himself.65 When the government agent fails to provide Miranda warnings to a person interviewed while in custody, the statement generally may not be used as evidence in criminal proceedings.66

The suspect making the statement must be "in custody." Generally, this occurs when, because of a show of government authority, a reasonable person would not feel free to leave. Additionally, the statement must be uttered while the suspect was under interrogation. "In custody" may include situations where the individual physically cannot leave, such as when a public health official conducts a hospital bedside interview in the presence of a police officer. In such case, custody would depend on whether a reasonable person would feel free to decline to answer the questions posed.

The Fifth Amendment does not require suppression of statements that a suspect volunteers, for example, if a suspect volunteers after arrest that he has a biological agent in his apartment.67 Additionally, emergency circumstances might provide an exception to the requirement that Miranda warnings be provided prior to a custodial interrogation. For example, a "public safety" exception might apply to custodial questions posed in an attempt to avert an immediate threat. For example, a suspect caught in the act of making a bioterrorist threat of immediate danger may be asked where else he released biological agents prior to Miranda warnings.68

Usually, public health investigators need not be concerned with Miranda warnings because they conduct most investigations alone and typically do not conduct criminal investigations. However, Fifth Amendment issues might arise during a public health investigation if, for example, individuals who are interviewed as witnesses or victims of a disease-causing agent come to be considered suspect perpetrators. Fifth Amendment challenges are most likely to occur during interviews conducted jointly by public health investigators and law enforcement or public health interviews that are conducted in the presence of law enforcement. Fifth Amendment concerns might also arise if public health investigators interview suspects for the purpose of gathering evidence of criminal activity for the police.

V. Federal Statutes and Public Health Information Sharing with Law Enforcement

The applicability of mandated federal reporting and the HIPAA Privacy Rule are discussed below. However, it is beyond the scope of this Issue Brief to identify all federal statutes that might be relevant to information sharing by state and local public health agencies with law enforcement.

Public Health and Federal Reporting

Public health agencies may be compelled to provide identifiable information to law enforcement, for example, by an FBI administrative order issued under the Patriot Act,69 federal subpoena, or other legal process. However, generally, there appears to be no federal statute mandating state or local public health agencies to report information regarding suspicious activity or other indications of possible bioterrorism or other threats. Federal laws, such as the National Security Act,70 authorize the federal government to collect such information; however, national reporting is not mandated. Thus, state and local public health agencies may provide information for law enforcement purposes, either as required or permitted by their state's law.

Some public health agencies, or programs or services within public health agencies, are covered by the federal Privacy Rule71 adopted by the U.S. Department of Health and Human Services under the Health Insurance Portability and Accountability Act (HIPAA).72 The Privacy Rule established national minimum standards to protect the privacy of individually identifiable health information (referred to as "protected health information" or "PHI") and gives patients an array of rights with respect to that information. PHI is individually identifiable health information that relates to physical or mental health or condition, the provision of healthcare to the individual, or any payment for the provision of healthcare.73 A covered entity is prohibited from using or disclosing PHI without the written authorization of the patient unless required or permitted by the Privacy Rule. A covered entity that violates the Privacy Rule is subject to civil or criminal penalties.

The Public Health and Schools Toolkit discusses HIPAA applicability to public health agencies. Depending on a public health agency's organization and functions, it may or may not be covered by the Privacy Rule. To the extent that the Privacy Rule applies, it should allow public health agencies to disclose information to law enforcement in many situations that involve disease control, bioterrorism, or other public health threats. In this regard, the Privacy Rule is balanced to protect an individual's privacy while allowing important law enforcement functions to continue.

The Privacy Rule does not apply to "de-identified information," such as aggregate statistical data or data stripped of individual identifiers.74 This data requires no individual privacy protections and may be disclosed to law enforcement and others without authorization.75 Information may be de-identified using either the safe harbor method or the statistical de-identification method. For the safe harbor method, the covered entity de-identifies data by removing 18 identifiers specified in the Privacy Rule.76 The information is deemed de-identified provided that the covered entity does not have actual knowledge that the remaining information can be used alone or in combination with other reasonably available information to identify a subject. These identifiers include personal identifiers (such as name, address, telephone number, birth date, and social security number) and non-personal identifiers (such as geographic information smaller than a state and dates directly associated with an individual). Alternatively, a covered entity can rely on a determination by a properly qualified statistician using accepted analytic techniques who concludes the risk of re-identification is substantially limited.

The Privacy Rule also permits covered entities to disclose PHI to law enforcement officials77 without the individual's authorization under specific circumstances described below.

To report PHI to law enforcement when required by law to do so.78 For example, the Privacy Rule permits disclosures of PHI as necessary to comply with state laws that require healthcare providers to report incidents of gunshot, stab wounds, or other violent injuries.

To comply with a court order or court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena.79 The Rule recognizes that the legal process in obtaining a court order and the secrecy of the grand jury process provides protections for the individual's private information.

To respond to an administrative request, including an administrative subpoena or summons, a civil or authorized investigative demand, or similar process authorized by law.80 Because an administrative request may be made without judicial involvement, the Privacy Rule requires all administrative requests to include or be accompanied by a written statement that the information requested is relevant and material, specific and limited in scope, and that de-identified information cannot be used.

To respond to a request for PHI for purposes of identifying or locating a suspect, fugitive, material witness, or missing person.81 Under this exception, the covered entity must limit disclosures of PHI to name and address, date and place of birth, social security number, ABO blood type and rh factor, type of injury, date and time of treatment, date and time of death, and a description of distinguishing physical characteristics. Other information related to the individual's DNA, dental records, body fluid or tissue typing, samples, or analysis cannot be disclosed under this provision, but may be disclosed in response to a court order, warrant, or written administrative request.

When information about a suspected perpetrator of a crime is disclosed when the report is made by the victim who is a member of the covered entity's workforce.82

To respond to a request for PHI about a victim of a crime when the victim agrees.83 If, because of an emergency or the person's incapacity, the individual cannot agree, the covered entity may disclose the PHI if law enforcement officials represent that the PHI is not intended to be used against the victim, is needed to determine whether another person broke the law, that the investigation would be materially and adversely affected by waiting until the victim could agree, and the covered entity believes in its professional judgment that doing so is in the best interests of the individual whose information is requested.

To alert law enforcement to the death of an individual, when there is a suspicion that death resulted from criminal conduct.84

To report PHI that the covered entity in good faith believes to be evidence of a crime that occurred on the covered entity's premises.85

When responding to an off-site medical emergency, as necessary to alert law enforcement about criminal activity, specifically, the commission and nature of the crime, the location of the crime or any victims, and the identity, description, and location of the perpetrator of the crime.86 This provision does not apply if the covered healthcare provider believes that the individual in need of the emergency medical care is the victim of abuse, neglect, or domestic violence.87

To coroners or medical examiners to assist them in identifying the decedent, determining the cause of death, or to carry out their other authorized duties.88

To a law enforcement official reasonably able toprevent or lessen a serious and imminent threat to the health or safety of an individual or the public.89

To identify or apprehend an individual who has admitted participation in a violent crime that the covered entity reasonably believes may have caused serious physical harm to a victim, provided that the admission was not made in the course of or based on the individual's request for therapy, counseling, or treatment related to the propensity to commit this type of violent act.90

To identify or apprehend an individual who appears to have escaped from lawful custody.91

To federal officials authorized to conduct intelligence, counterintelligence, and other national security activities under the National Security Act or to provide protective services to the president and others and conduct related investigations.92

To respond to a request for PHI by a correctional institution or a law enforcement official having lawful custody of an inmate or others if they represent such PHI is needed to provide healthcare to the individual; for the health and safety of the individual, other inmates, officers or employees of or others at a correctional institution or responsible for transporting or transferring inmates; or for the administration and maintenance of the safety, security, and good order of the correctional facility, including law enforcement on the premises of the facility.93

The text of the provisions summarized above should be reviewed to ensure that conditions and requirements for disclosure are met. Except when required by law, these disclosures to law enforcement are subject to a minimum necessary determination by the covered entity.94 When reasonable to do so, the covered entity may rely upon the representations of the law enforcement official as to what information is the minimum necessary for their lawful purpose.95 If the law enforcement official making the request for information is not known to the covered entity, then the covered entity must verify the identity and authority of such person prior to disclosing the information.96

VI. State Statutes and Public Health Information Sharing with Law Enforcement

Generally, state law establishes the authority for reporting, collecting, using, and disclosing information for emergency preparedness and response. Before sharing information, state law must be reviewed with regard to each type of information that is proposed to be shared. In addition to-or in lieu of-laws specific to certain types of data, laws that cover public health powers and responsibilities, health information, and privacy might also apply or provide context for data-specific laws.

Exercising the state's police power to protect the public's health during emergencies-as well as from more routine threats-requires balancing the common good with safeguarding individual liberty interests, including autonomy and expectations of privacy.97 State laws enacted to protect the public's health, safety, and welfare vary in their balance of individual privacy and the common good. Five state laws below demonstrate this variation with regard to confidentiality of disease reports and public health investigations and permissible disclosure to law enforcement.

North Carolina. The Public Health Law of North Carolina contains extensive provisions regarding the collection and sharing of information, including identifiable health information, by public health with law enforcement to prevent or control a public health threat. A public health agency may release identifiable information to a court or law enforcement official related to an occurring or threatened public health emergency or terrorist incident using nuclear, biological, or chemical agents. Law enforcement may not re-disclose identifiable information except when necessary to investigate a terrorist incident or as authorized by the state or local health director to assist with preventing or controlling a public health threat.98

Illinois. The Department of Public Health Act explicitly requires a public health agency to notify law enforcement and other agencies regarding illnesses, unusual disease symptom clusters, or suspicious events that it reasonably believes have the potential to be the cause of or related to a public health emergency. The public health agency is to provide law enforcement with information necessary for investigation, prevention, or management of an emergency or to conduct a criminal investigation or prosecution arising out of the matter. No information containing the identity or tending to reveal the identity of any person may be re-disclosed by law enforcement except in a prosecution of that person for the commission of a crime.99

Michigan. The Michigan Public Health Code requires that the state health department promulgate rules to provide for the confidentiality of reports, records, and data pertaining to testing, care, treatment, reporting, and research associated with communicable diseases or infections. These rules provide that medical and epidemiological information gathered in connection with an investigation that identifies an individual is confidential. Identifiable information can be disclosed with consent or without consent if necessary, to protect the public health as determined by the state or local health officer.100

Texas. Under the Texas Health and Safety Code, reports, records, and information received from any source that relate to cases or suspected cases of diseases or health conditions are confidential. This information may be released to law enforcement personnel to the extent necessary during a public health disaster solely for the purpose of protecting the health or life of the person identified in the report, record, or information. Only the minimum necessary information may be released under this subsection, as determined by the health department.101

Nebraska. Nebraska's law states that when case reports and positive lab results must be reported to a public health agency, "such reports or notifications and the resulting investigations shall be confidential except as provided in this section, shall not be subject to subpoena, and shall be privileged and inadmissible in evidence in any legal proceeding of any kind or character and shall not be disclosed to any other department or agency of the State of Nebraska." The section allows non-identifiable information to be reported to CDC to further the protection of public health and identifiable information to be provided to other health departments to ensure that investigations deemed necessary are made.102

Some states, like North Carolina, Illinois, and Texas, explicitly address information sharing with law enforcement regarding case reports and investigations. Although Michigan's law does not mention law enforcement, its general provision could allow disclosure of identifiable medical and epidemiological information to law enforcement if necessary to protect the public health. The decision to disclose identifiable health information must be made by the state or local health officer. Even though Texas' law allows sharing with law enforcement, the purpose must be to protect the health or life of the person identified in the report, record, or information, which might present challenges in protecting the public generally. Nebraska's law is extremely narrow and may present challenges to providing information to law enforcement even when circumstances are compelling.

States should assess their laws to determine whether public health agencies are able to share necessary information with law enforcement, the prerequisites and limits for such sharing, alternatives for communicating information when necessary to protect the public's health and consent is not an option, and the need for legislative revisions to address gaps.

Legal process might be an option to compel information sharing, such as court orders, search warrants, grand jury subpoenas, and FBI administrative orders under the Patriot Act. In the event of a declared disaster or emergency, a state's emergency management act might allow the governor to suspend state laws or issue executive directives to enable information sharing with law enforcement as necessary for emergency response. There may be rare but compelling circumstances where disclosure may be necessary, even though state law provides no applicable exception to privacy protections. A health official facing a decision about revealing confidential information to protect a third party or the general community should consult with his or her attorney to identify relevant legal responsibilities and evaluate competing moral claims. The health official should review restrictive language with counsel to determine permissible interpretations and avoid results that might prevent public health from carrying out responsibilities to protect the public. The situation and bases for action should be documented in case subsequent events lead to second guessing.

Conclusion

Partnerships between law enforcement and public health agencies are important to emergency preparedness and effective response, whether the emergency is caused by natural, accidental, or intentional means. Information sharing may be necessary for public health agencies and law enforcement to both collaborate and carry out their respective functions during a public health emergency. Public health agencies should review legal authorities that apply to sharing information with law enforcement both when a disaster has been and has not been declared. As a result, barriers to sharing needed information will be more apparent and solutions can be identified.

Public health emergencies may involve criminal activities, resulting in joint or parallel public health and criminal investigations. Public health officials and law enforcement officers need to understand their respective roles and the different legal standards that govern their investigations and collection of information and evidence. Joint investigative training may be valuable, promoting effective response to protect the public health and ensure successful prosecution of perpetrators of bioterrorism and other crimes.

CDC and Bureau of Justice Assistance. "A Framework for Improving Cross-Sector Coordination for Emergency Preparedness and Response, Action Steps for Public Health, Law Enforcement, the Judiciary, and Corrections." July 2008. Available at http://cdc.gov/phlp/docs/CDC_BJA_Framework.pdf. Accessed June 29, 2012.

CDC and Bureau of Justice Assistance. "A Framework for Improving Cross-Sector Coordination for Emergency Preparedness and Response, Action Steps for Public Health, Law Enforcement, the Judiciary and Corrections." July 2008. Available at http://cdc.gov/phlp/docs/CDC_BJA_Framework.pdf. Accessed June 29, 2012.

U.S. Department of Justice and Bureau of Justice Assistance. "The Role of Law Enforcement in Public Health Emergencies: Special Considerations for an All-Hazards Approach." September 2006. Available at https://www.ncjrs.gov/pdffiles1/bja/214333.pdf. Accessed June 29, 2012.

CDC and Bureau of Justice Assistance. "A Framework for Improving Cross-Sector Coordination for Emergency Preparedness and Response, Action Steps for Public Health, Law Enforcement, the Judiciary and Corrections." July 2008. Available at http://cdc.gov/phlp/docs/CDC_BJA_Framework.pdf. Accessed June 29, 2012. See also Goodman RA, Munson JW, Dammer K, Lazzarini Z, Barkely JP. "Forensic Epidemiology: Law at the Intersection of Public Health and Criminal Investigations." Journal of the American Society of Law, Medicine & Ethics. 2003. 31(4):684-700.

Sutton V. "Dual Purpose Bioterrorism Investigations in Law Enforcement and Public Health Protection: How to Make Them Work Consistent with the Rule of Law." Houston Journal of Health Law & Policy. 2006. 6:151-170. Available at http://www.law.uh.edu/hjhlp/Issues%5CVol_61%5CSutton.pdf. Accessed Nov. 15, 2012.

U.S. Department of Justice and Bureau of Justice Assistance. "The Role of Law Enforcement in Public Health Emergencies: Special Considerations for an All-Hazards Approach." September 2006. Available at https://www.ncjrs.gov/pdffiles1/bja/214333.pdf. Accessed June 29, 2012; Jacobson v. Massachusetts, 197 U.S. 11 (1905).

CDC and Bureau of Justice Assistance. "A Framework for Improving Cross-Sector Coordination for Emergency Preparedness and Response, Action Steps for Public Health, Law Enforcement, the Judiciary, and Corrections." July 2008. Available at http://cdc.gov/phlp/docs/CDC_BJA_Framework.pdf. Accessed June 29, 2012.

U.S. Department of Homeland Security and U.S. Department of Justice. "Baseline Capabilities for State and Major Urban Area Fusion Centers. A Supplement to the Fusion Center Guidelines." September 2008. Available here. Accessed June 29, 2012.

U.S. Department of Homeland Security and U.S. Department of Justice. "Health Security: Public Health and Medical Integration for Fusion Centers." July 2011. Available here. Accessed June 29, 2012.

U.S. Department of Homeland Security and U.S. Department of Justice. "Fusion Center Privacy Policy Development-Privacy Civil Rights, and Civil Liberties Policy Template" April 2010. Available at http://www.it.ojp.gov/docdownloader.aspx?ddid=1269. Accessed June 29, 2012.

The National Security Act of 1947, as amended; The Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA), as amended; Presidential Memorandum dated April 10, 2007 (Assignment of Functions Relating to the Information Sharing Environment); Presidential Memorandum dated December 16, 2005 (Guidelines and Requirements in Support of the Information Sharing Environment); DNI memorandum dated May 2, 2007 (Program Manager's Responsibilities); Executive Order 13388; and other applicable provisions of law.

CDC and Bureau of Justice Assistance. "A Framework for Improving Cross-Sector Coordination for Emergency Preparedness and Response, Action Steps for Public Health, Law Enforcement, the Judiciary, and Corrections." July 2008. Available at http://cdc.gov/phlp/docs/CDC_BJA_Framework.pdf. Accessed June 29, 2012.

N.C. Gen. Stat. § 130A-143; N.C. Gen. Stat. § 130A-476.

20 I.L.C.S. 2305/2.1.

M.C.L.§ 333.5111(3); R 325.181.

Tx Health & S. §81.046.

R.R.S. Neb. § 71-503.01.

Note: This document was compiled from April–November 2012 and reflects the laws and programs current then. It reflects only portions of the laws relevant to public health emergencies and is not intended to be exhaustive of all relevant legal authority. This resource is for informational purposes only and is not intended as a substitute for professional legal or other advice. The document was funded by CDC Award No. 1U38HM000454 to the Association of State and Territorial Health Officials; Subcontractor Subcontractor University of Michigan School of Public Health, Network for Public Health Law – Mid-States Region.